74db4ae35512c9a7be17f01544b2a5bd56b3b256edb3f179e76b59951f222175

Analysis

max time kernel
72s
max time network
86s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NovaInstaller.exe
Size

152.1MB
MD5

6196a6ac54713dc0d11c7ebab96bc6d0
SHA1

594c07c73f5844f74dc80b79f9d29ae0c9591f3f
SHA256

74db4ae35512c9a7be17f01544b2a5bd56b3b256edb3f179e76b59951f222175
SHA512

613b185438c693c25e55174eaf2dc5e8d36b57f462c82ab318276219b0bdadb1f145712b9dbb4bd49ad60dfc8e9176428c6cceaac3ff615c13e60e74153724c7
SSDEEP

786432:65Nre6UmdCvF4N3RtI9n1gqBf8ICtZNXDPWsUwZnb5xFTtLwSTRpf4P1wT1vdvmu:A5UmamUyqtSyctjdegUc

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2052	windowsdesktop-runtime-6.0.15-win-x64.exe
1332	windowsdesktop-runtime-6.0.15-win-x64.exe
2212	windowsdesktop-runtime-6.0.21-win-x64.exe
2516	dotnet-sdk-6.0.405-win-x64.exe

Loads dropped DLL 12 IoCs

pid	Process
1128	NovaInstaller.exe
1128	NovaInstaller.exe
1128	NovaInstaller.exe
2052	windowsdesktop-runtime-6.0.15-win-x64.exe
1332	windowsdesktop-runtime-6.0.15-win-x64.exe
1332	windowsdesktop-runtime-6.0.15-win-x64.exe
2656	MsiExec.exe
2628	MsiExec.exe
2452	msiexec.exe
2452	msiexec.exe
1604	MsiExec.exe
1936	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0f39db03-9030-48f3-82ef-5384bed81d85} = "\"C:\\ProgramData\\Package Cache\\{0f39db03-9030-48f3-82ef-5384bed81d85}\\windowsdesktop-runtime-6.0.21-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.21-win-x64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
11	2452	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-namedpipe-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\it\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Threading.Thread.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Text.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-synch-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\it\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Security.Cryptography.Pkcs.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\fr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\clrjit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\mscorrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-sysinfo-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Xaml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.WebClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-processthreads-l1-1-1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-libraryloader-l1-1-0.dll	msiexec.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f76be31.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76be3a.ipi	msiexec.exe
File created	C:\Windows\Installer\f76be3d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76be46.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76be34.ipi	msiexec.exe
File created	C:\Windows\Installer\f76be37.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76be37.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDFD2.tmp	msiexec.exe
File created	C:\Windows\Installer\f76be43.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFEE3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE487.tmp	msiexec.exe
File created	C:\Windows\Installer\f76be42.msi	msiexec.exe
File created	C:\Windows\Installer\f76be46.ipi	msiexec.exe
File created	C:\Windows\Installer\f76be36.msi	msiexec.exe
File created	C:\Windows\Installer\f76be3a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76be43.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC0C.tmp	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	windowsdesktop-runtime-6.0.21-win-x64.exe
File opened for modification	C:\Windows\Installer\f76be31.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC94C.tmp	msiexec.exe
File created	C:\Windows\Installer\f76be3c.msi	msiexec.exe
File created	C:\Windows\Installer\f76be48.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF43.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76be3d.msi	msiexec.exe
File created	C:\Windows\Installer\f76be40.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6CB.tmp	msiexec.exe
File created	C:\Windows\Installer\f76be34.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID65A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76be40.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D937EF87-F11D-4778-973C-B71E178F95D0}v48.87.64667\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.87.64667_x64\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.21 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78FE739DD11F877479C37BE171F8590D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D937EF87-F11D-4778-973C-B71E178F95D0}v48.87.64667\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\Version = "811072723"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\ProductName = "Microsoft Windows Desktop Runtime - 6.0.21 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\DisplayName = "Microsoft .NET Runtime - 6.0.21 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Version = "811072667"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE3E5325A595AB443B7CED4E083B14EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\16F350F7730518B71214A03200AA04D5\DD7FB6FA21B25C0419C9E29C0945BB1E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.87.64667_x64\Version = "48.87.64667"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DD7FB6FA21B25C0419C9E29C0945BB1E\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8D2EC92E-5903-4B25-9406-182B8EFA834F}v48.87.64667\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64\Version = "48.87.64723"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\16F350F7730518B71214A03200AA04D5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.87.64667_x64\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64\ = "{AF6BF7DD-2B12-40C5-919C-2EC99054BBE1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8D2EC92E-5903-4B25-9406-182B8EFA834F}v48.87.64667\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.87.64667_x64\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78FE739DD11F877479C37BE171F8590D\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\PackageCode = "A7A24D16586B4A24EA31CD8176AD2C20"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E29CE2D8309552B4496081B2E8AF38F4\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\Version = "811072667"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\527B4FA944956476D4A7C20451951DD2\78FE739DD11F877479C37BE171F8590D	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}v48.87.64667\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DD7FB6FA21B25C0419C9E29C0945BB1E\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.87.64667_x64\ = "{D937EF87-F11D-4778-973C-B71E178F95D0}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\PackageCode = "44C0CE721D44C91429496EFE8E61E9A2"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\Version = "811072667"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.21 (x64)"	msiexec.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	NovaInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	NovaInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	NovaInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	NovaInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	NovaInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	NovaInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	NovaInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	NovaInstaller.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2452	msiexec.exe
2452	msiexec.exe
2452	msiexec.exe
2452	msiexec.exe
2452	msiexec.exe
2452	msiexec.exe
2452	msiexec.exe
2452	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	NovaInstaller.exe
Token: SeShutdownPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeSecurityPrivilege	2452	msiexec.exe
Token: SeCreateTokenPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLockMemoryPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeMachineAccountPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTcbPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSecurityPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTakeOwnershipPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLoadDriverPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemProfilePrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemtimePrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeProfSingleProcessPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncBasePriorityPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePagefilePrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePermanentPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeBackupPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeShutdownPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeDebugPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAuditPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeChangeNotifyPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRemoteShutdownPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeUndockPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSyncAgentPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeEnableDelegationPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeManageVolumePrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeImpersonatePrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreateGlobalPrivilege	2212	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2052	1128	NovaInstaller.exe	28
PID 1128 wrote to memory of 2052	1128	NovaInstaller.exe	28
PID 1128 wrote to memory of 2052	1128	NovaInstaller.exe	28
PID 1128 wrote to memory of 2052	1128	NovaInstaller.exe	28
PID 1128 wrote to memory of 2052	1128	NovaInstaller.exe	28
PID 1128 wrote to memory of 2052	1128	NovaInstaller.exe	28
PID 1128 wrote to memory of 2052	1128	NovaInstaller.exe	28
PID 2052 wrote to memory of 1332	2052	windowsdesktop-runtime-6.0.15-win-x64.exe	29
PID 2052 wrote to memory of 1332	2052	windowsdesktop-runtime-6.0.15-win-x64.exe	29
PID 2052 wrote to memory of 1332	2052	windowsdesktop-runtime-6.0.15-win-x64.exe	29
PID 2052 wrote to memory of 1332	2052	windowsdesktop-runtime-6.0.15-win-x64.exe	29
PID 2052 wrote to memory of 1332	2052	windowsdesktop-runtime-6.0.15-win-x64.exe	29
PID 2052 wrote to memory of 1332	2052	windowsdesktop-runtime-6.0.15-win-x64.exe	29
PID 2052 wrote to memory of 1332	2052	windowsdesktop-runtime-6.0.15-win-x64.exe	29
PID 1332 wrote to memory of 2212	1332	windowsdesktop-runtime-6.0.15-win-x64.exe	30
PID 1332 wrote to memory of 2212	1332	windowsdesktop-runtime-6.0.15-win-x64.exe	30
PID 1332 wrote to memory of 2212	1332	windowsdesktop-runtime-6.0.15-win-x64.exe	30
PID 1332 wrote to memory of 2212	1332	windowsdesktop-runtime-6.0.15-win-x64.exe	30
PID 1332 wrote to memory of 2212	1332	windowsdesktop-runtime-6.0.15-win-x64.exe	30
PID 1332 wrote to memory of 2212	1332	windowsdesktop-runtime-6.0.15-win-x64.exe	30
PID 1332 wrote to memory of 2212	1332	windowsdesktop-runtime-6.0.15-win-x64.exe	30
PID 2452 wrote to memory of 2656	2452	msiexec.exe	33
PID 2452 wrote to memory of 2656	2452	msiexec.exe	33
PID 2452 wrote to memory of 2656	2452	msiexec.exe	33
PID 2452 wrote to memory of 2656	2452	msiexec.exe	33
PID 2452 wrote to memory of 2656	2452	msiexec.exe	33
PID 2452 wrote to memory of 2656	2452	msiexec.exe	33
PID 2452 wrote to memory of 2656	2452	msiexec.exe	33
PID 2452 wrote to memory of 2628	2452	msiexec.exe	35
PID 2452 wrote to memory of 2628	2452	msiexec.exe	35
PID 2452 wrote to memory of 2628	2452	msiexec.exe	35
PID 2452 wrote to memory of 2628	2452	msiexec.exe	35
PID 2452 wrote to memory of 2628	2452	msiexec.exe	35
PID 2452 wrote to memory of 2628	2452	msiexec.exe	35
PID 2452 wrote to memory of 2628	2452	msiexec.exe	35
PID 2452 wrote to memory of 1604	2452	msiexec.exe	36
PID 2452 wrote to memory of 1604	2452	msiexec.exe	36
PID 2452 wrote to memory of 1604	2452	msiexec.exe	36
PID 2452 wrote to memory of 1604	2452	msiexec.exe	36
PID 2452 wrote to memory of 1604	2452	msiexec.exe	36
PID 2452 wrote to memory of 1604	2452	msiexec.exe	36
PID 2452 wrote to memory of 1604	2452	msiexec.exe	36
PID 2452 wrote to memory of 1936	2452	msiexec.exe	37
PID 2452 wrote to memory of 1936	2452	msiexec.exe	37
PID 2452 wrote to memory of 1936	2452	msiexec.exe	37
PID 2452 wrote to memory of 1936	2452	msiexec.exe	37
PID 2452 wrote to memory of 1936	2452	msiexec.exe	37
PID 2452 wrote to memory of 1936	2452	msiexec.exe	37
PID 2452 wrote to memory of 1936	2452	msiexec.exe	37
PID 1128 wrote to memory of 2516	1128	NovaInstaller.exe	38
PID 1128 wrote to memory of 2516	1128	NovaInstaller.exe	38
PID 1128 wrote to memory of 2516	1128	NovaInstaller.exe	38
PID 1128 wrote to memory of 2516	1128	NovaInstaller.exe	38
PID 1128 wrote to memory of 2516	1128	NovaInstaller.exe	38
PID 1128 wrote to memory of 2516	1128	NovaInstaller.exe	38
PID 1128 wrote to memory of 2516	1128	NovaInstaller.exe	38

C:\Users\Admin\AppData\Local\Temp\NovaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\NovaInstaller.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe
  "windowsdesktop-runtime-6.0.15-win-x64.exe" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\Temp\{AAD18A95-316C-4898-A14F-AA6152579D12}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
    "C:\Windows\Temp\{AAD18A95-316C-4898-A14F-AA6152579D12}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.filehandle.attached=184 -burn.filehandle.self=192 /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
      "C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{75B831BF-E195-4441-80CE-E181FF3475F1} {EE8C3BC9-9C60-4959-A522-E4F9CE68562E} 1332
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2212
- C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe
  "dotnet-sdk-6.0.405-win-x64.exe" /install /quiet
  2⤵
  - Executes dropped EXE
  PID:2516
- - C:\Windows\Temp\{0879161F-3D44-4A4F-BEAA-99BA6ACC84F9}\.cr\dotnet-sdk-6.0.405-win-x64.exe
    "C:\Windows\Temp\{0879161F-3D44-4A4F-BEAA-99BA6ACC84F9}\.cr\dotnet-sdk-6.0.405-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe" -burn.filehandle.attached=184 -burn.filehandle.self=192 /install /quiet
    3⤵
    PID:2888
  - - C:\Windows\Temp\{A992209E-C018-4A1C-980C-3159D957ADC9}\.be\dotnet-sdk-6.0.413-win-x86.exe
      "C:\Windows\Temp\{A992209E-C018-4A1C-980C-3159D957ADC9}\.be\dotnet-sdk-6.0.413-win-x86.exe" -q -burn.elevated BurnPipe.{9304B30E-E76A-43F8-897D-A531FD9BB5AF} {2A234055-31F6-44D3-8765-19B2F9D4FCE6} 2888
      4⤵
      PID:2248

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 31295EA72271F9F817CFD98E46335F63
  2⤵
  - Loads dropped DLL
  PID:2656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B63CD0A47699C942031C525100A5BBF3
  2⤵
  - Loads dropped DLL
  PID:2628
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9D75747968685A07486038582E9F3CE
  2⤵
  - Loads dropped DLL
  PID:1604
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3135D00F35C72433512981F42BDDA40E
  2⤵
  - Loads dropped DLL
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76be35.rbs

Filesize
55KB

MD5
8b32c93d9b08b85cd61d5183839af601

SHA1
d62001bb534304035d75a1164093d78f8f40087c

SHA256
8a8101c0b2efaf2567ac118029d7e4b6a6e304fac966f7018bc678ace95b6369

SHA512
74ccaec06043fa53b6c369fa46d55714868d9af53fb6bc86282d2f3d0f24e992ca36ff1a552a3dfdc05f051dacd8c0ee961a40b93985bdf51b890adb51ffe137

Download Submit
C:\Config.Msi\f76be3b.rbs

Filesize
8KB

MD5
85ee7f2103b82832299861d8b35d9a63

SHA1
4f8c272e54d05ea3ba4efd68d1c8580d38115640

SHA256
5a08164a6172b70f4bd0e30cdffd7f7197793abc69996a317306516011954c8e

SHA512
c5edcec8a6fd3f0d3e02004e6a07aaf2dacb54ccb41c8ee360d76cb015d1e5ed6f438e2ff54ef6a256bdc5491b739547cdd37a8cc172ae092eb2acf11e4b7302

Download Submit
C:\Config.Msi\f76be41.rbs

Filesize
9KB

MD5
4b1e669052e531d0606d63657860e9a2

SHA1
fc9c0df7b27cef6fa12eb2fe62c1bbac46879cf9

SHA256
5798eed1a69f7235d071519bed92a995b34f648e4bd19e52d6df6d3a63de4328

SHA512
ebb0dd21d0f24212746e690122d42026ab41e0b8f7dbf56b824196d2743e783575cb810de0a1bb1d6f603b696a0eb6148f5eff9eaefb44d4a37269049f51f690

Download Submit
C:\Config.Msi\f76be47.rbs

Filesize
87KB

MD5
a87fa05ac08bc29f88dc6470b22f2a6a

SHA1
58426f99717105bf1ffec7ed6234f4e7841f1c3d

SHA256
877bbc3ed153f3daf76c87134338b39faa5445caed0fa18c911b54ee36a34429

SHA512
e51484b4c0aafbf6773cb498f216d058b4d3e738f9a4fcb14ef31d61d80ad11825fe8d5bf8808d0d97dd5632b6700f5a118af6f3f7781a487df6aa91f00ced37

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4b95650421aebc31cac11637fe4e1dd

SHA1
89a66da71c4f974cb17b6da5f0d20386c13e56d3

SHA256
77e0fd11772af4efb96dddb169a0640f7299a0cf5d82ec9e3f562795914b60c6

SHA512
86be0c23c07cf6f0b003024c00de0331163dfe9126928e18800f9537f4be7ea5436805a377a4f7bc483b37d5d7471cacd32676c41d9ee16368c2da59e3deb640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbd5ae324ca42bdb4d0db9f271845686

SHA1
5c97094bb07b333a13f8d41f5f454011288aec3c

SHA256
98263b97ccbc2add83b84787701f485d71023a3f4618a54ba87d005df25469c1

SHA512
a8819d3318b227e1bc8920a40d42636ba3f90f849191d18e46a12d8ec1aaecdce0854afdccf6789fd99988d42264f42ad9abc986b2eb43204188344c39460694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66517f857ec4038bd328b91575a112d7

SHA1
7753c98ef2d60d57bbfd5d4b359e6a6c9153004a

SHA256
5b34f4f524d9be2d25c57e05b38ca5c79486fc754c5d5b698c9b21887e54146d

SHA512
f69640336f17049eb6437b866a4b846fcf5f888662f3699f3191b36f47efe4903129eb600ee96f20c2ec5417eedd3d6eaadc329447491432b20151083a96e9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f985d8171c52948f48cea4b9e0a3c4

SHA1
9bf2d0094dcc8651599aefcc81a7f015ddfebd3e

SHA256
767a76aad05d5ba96fea3b4efc67f30be7feacc402abf06b66d452c4c639adbd

SHA512
b0f2c166a12d7cddc4d373e32de2263a6765fd0153f1ab7ca2d1ea65b49936e67a8d791f2600a3c02c948b01fce728ddec7aeeccf79c7d8d8ea4c5cda3d8ceb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f6a47bb8675971f8ebcf377011d826b

SHA1
620fdea5747e491ccaaa76b91933b47c9bd210f1

SHA256
d6e2715db827fc8eb6be27d3dd01e13b48d4332745d0bfe2f7c2d565a3457dae

SHA512
bfba4581179cc752d768b43fa9ffeef4fcce8a8464794db0005f0c0755cee900430ff591e3d2aed12cf574d5974f27f9af33a8e2ab246e8fc934998e7264170d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e79ed3401eb192f46ebf2ae29b862a4

SHA1
b20f141e9395921b7826f59c18137037f2f92cfe

SHA256
242cff90f04448f9f8e6b514cb030fc7d44560eb3eed520953b3b893b7f5309d

SHA512
ceb93e7da4d949bb7edd46ad35caff6f2f21c18626ecc24e5963681f8a454e42df0e4735bd1a89a48f9ad63e9490db6f9cf8167e6c7542c1d448ca5ad780505e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab78BB.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231105101628_000_dotnet_runtime_6.0.21_win_x64.msi.log

Filesize
3KB

MD5
5bea60e9df78b56404b642163d278f43

SHA1
0f7188b8b1c00a177bc18c48aba7ec670283f73e

SHA256
38cbc2976e7db65e64062a78e7ac31b16fc9147861c83b5cbd4dd563d28ac897

SHA512
77285f69f11a0dc95577d1f00984a18fb1f357460d9158776420bf3bc832de2f1a471ca667c1d8e615e8e54aaaaee0f811cc173a01bd157b086622982d08a96d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231105101628_001_dotnet_hostfxr_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
772708e8b587d4426377e43e0de86efb

SHA1
677ea2eb588fc77a33e774e60c69a60f1fe4c158

SHA256
f1bc57892fb2bf6e3dee13bb4ba005b563575498228c8b8455676cbd8242557d

SHA512
72c0debf514be1b96923c84d2a5ae3f104f3eeba7ad180242dff3428d338d1a121820e7ac2d8a8f358619ea3cfc2ea4827ae39808bf2556a86a389e5df899b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231105101628_002_dotnet_host_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
dab0b46f7d9236f36938219d563bf40b

SHA1
17f32a69fcd07b3e51e13c01a9f8b2e161403438

SHA256
abb8087e75a973f1c6919b148577dd2fb754e39d2c8adabbd356776d78d1c835

SHA512
5357796c5d48010385dd3491bdb065b60cdc036df341abdc234f4ae40cc5368d3aa38d8ed60e2b70bf2e6cc0fa2e91b85e1a42ef2ac1daed5ff9c37578040416

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231105101628_003_windowsdesktop_runtime_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
a090c133ce2baa3488bf224fdfd05a63

SHA1
5592eb9b1b98f0053388a7b32d89eadced7dfb8c

SHA256
2bb7655bf601a94cde4bf86528a046abd8597a94912adc73930dcc1889628610

SHA512
4e0abebe84c391a089b29e047ad5badefec1aa70bce4703ecb4d507bf6c38ae7ce7a2cbf7ff99d02a1b3c7f19b1b2cd78750e5a23c90aa300d38bcf0ab29d4c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar795A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe

Filesize
13.2MB

MD5
4bac52a97875e77dc6a87a951f29e159

SHA1
2e38fd61d98b73cbe2c342001acf4e3c87171753

SHA256
f189a42fc0e2f6f15066073d593f85997045d2de8fa400bc36b370d5980a7828

SHA512
22966a85b9fb035efe397c547db7bdcf870b1e58e3d45359d8e5b9d61048ac4ea47f234ff56a34f865c67ed6c4e8c6793b73d3d7ce0fc25578b846e8e04f7ce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe

Filesize
12.4MB

MD5
cb493c8592960402b3abbf6aac60785d

SHA1
b41f480770e414e6b60ecbfd8f80404cdfc46ae5

SHA256
d1fb5a4a3d276580ee3afce43bef24f781536e411178ce34de37b0fa9fca52bd

SHA512
c58a564bddfa4058a49153e5d25c9a4f19ee95d02825b9bd7bb86345aea398e61bb88f45fb1c190e97cb66e590f7532c82107eb20068ca91fa32212456f01f58

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
1a6d60add2d112dd73e83fb46dca474d

SHA1
8b374a54f508cfdb8c8176bfaef96f37edf7170b

SHA256
aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545

SHA512
49192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
1a6d60add2d112dd73e83fb46dca474d

SHA1
8b374a54f508cfdb8c8176bfaef96f37edf7170b

SHA256
aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545

SHA512
49192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79

Download Submit
C:\Windows\Installer\MSID65A.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIDFD2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIE6CB.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIE6CB.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIFEE3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\f76be36.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Installer\f76be37.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Installer\f76be43.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
C:\Windows\Temp\{0879161F-3D44-4A4F-BEAA-99BA6ACC84F9}\.cr\dotnet-sdk-6.0.405-win-x64.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{0879161F-3D44-4A4F-BEAA-99BA6ACC84F9}\.cr\dotnet-sdk-6.0.405-win-x64.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\dotnet_host_6.0.21_win_x64.msi

Filesize
736KB

MD5
12b8c5914e56f4bd933c8490f7f6cd45

SHA1
2ec135cdd97adbcfe7decb04f1a5e95b6f0614e3

SHA256
3b83682de5bfeabde75ffc34330f470df11ce5e62c2509c50b3e48e35130fa51

SHA512
ecc9ddd52d097ca6f643f7ce78399b01d37e776e30abb8b82b6278711716e6893528340b6719f8287848931759ae41427c252cb00df97742583dbe5d7ea4277a

Download Submit
C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\dotnet_hostfxr_6.0.21_win_x64.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\dotnet_runtime_6.0.21_win_x64.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\windowsdesktop_runtime_6.0.21_win_x64.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
C:\Windows\Temp\{A992209E-C018-4A1C-980C-3159D957ADC9}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{A992209E-C018-4A1C-980C-3159D957ADC9}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{A992209E-C018-4A1C-980C-3159D957ADC9}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{A992209E-C018-4A1C-980C-3159D957ADC9}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{AAD18A95-316C-4898-A14F-AA6152579D12}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{AAD18A95-316C-4898-A14F-AA6152579D12}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\WindowsUpdate.log

Filesize
16KB

MD5
a570849caf1a4e071c0a57b372a2abbd

SHA1
0be15881e77bf385a5cf07ff832f2a7e7962bc30

SHA256
3d47ddb4271ed5862fe158f7c05874998990b56c1a654a30cdc49ef26e7b66f4

SHA512
46181b0a13aae119124a028f630bbb92067243694ca0d63265cb22ff57553d77bb705d77bd28618999f4637439b2f9d5be596071f2da08e719d3885b8917d7a6

Download Submit
\Program Files\dotnet\dotnet.exe

Filesize
133KB

MD5
54a71118efdb67dbbe816765908b6cf4

SHA1
10d2e20e4042f91cdadd0a5bc1e09b9ea79eb88a

SHA256
d2607dbc6c95c252baaba299b659f156b388c6130ac846f79eb4c768f91a019f

SHA512
77a4a33340f5ac8b5eb7f690526bbc1fa31f6855354c98c44ff77b92fd6f560a15405bb22e747c217bb8343dc7b9390d0ff25ed8b405a95f601dc06222bbc000

Download Submit
\Program Files\dotnet\dotnet.exe

Filesize
133KB

MD5
54a71118efdb67dbbe816765908b6cf4

SHA1
10d2e20e4042f91cdadd0a5bc1e09b9ea79eb88a

SHA256
d2607dbc6c95c252baaba299b659f156b388c6130ac846f79eb4c768f91a019f

SHA512
77a4a33340f5ac8b5eb7f690526bbc1fa31f6855354c98c44ff77b92fd6f560a15405bb22e747c217bb8343dc7b9390d0ff25ed8b405a95f601dc06222bbc000

Download Submit
\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\uWcU5_6FXSwQ4UMNThCcNYZC4UGolsg=\D3DCompiler_47_cor3.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\uWcU5_6FXSwQ4UMNThCcNYZC4UGolsg=\PresentationNative_cor3.dll

Filesize
1.2MB

MD5
c7bcc68b81e965fe74ef58d503c58deb

SHA1
99990f204f7318eeb8de6f9664ebcd0d42ea81b7

SHA256
06cb4da78f5cfddece86329241a2af9d6390ce1082b02f7db2e3bf320215a23e

SHA512
cab2bc27eca0ee097324a2471c8228f1723cfef5df9971359eec7710082c122b26a7aa1d1e6faab75389438a358bbff2973ad67e8dd9046455b4c4ac880d858c

Download Submit
\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\uWcU5_6FXSwQ4UMNThCcNYZC4UGolsg=\wpfgfx_cor3.dll

Filesize
1.9MB

MD5
1b01746fe61beb761a643050823190b0

SHA1
927b12e4a733bcc51545c6a005838a24b8dc4dda

SHA256
f8c4d6eb1cfa9c5b6fb322a0c818a4f5d5ee44043c259e0262c0460513953fb8

SHA512
83eeb187e554588a5a4efbce0fcb7e9c30e718ec9f6d797a7add28036e3d4506cd3e78386522467d7ac967a60ac509a23edd79a1b9032a7e230d980b9f36080a

Download Submit
\Windows\Installer\MSID65A.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIDFD2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIE6CB.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIFEE3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Temp\{0879161F-3D44-4A4F-BEAA-99BA6ACC84F9}\.cr\dotnet-sdk-6.0.405-win-x64.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\Windows\Temp\{99597DA1-1000-4D6F-8EFA-55654D04449E}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
\Windows\Temp\{A992209E-C018-4A1C-980C-3159D957ADC9}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\Windows\Temp\{A992209E-C018-4A1C-980C-3159D957ADC9}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
\Windows\Temp\{AAD18A95-316C-4898-A14F-AA6152579D12}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
memory/1128-54-0x0000000022AB0000-0x0000000022AC2000-memory.dmp

Filesize
72KB

Download
memory/1128-18-0x0000000002400000-0x0000000002444000-memory.dmp

Filesize
272KB

Download
memory/1128-51-0x0000000022A90000-0x0000000022AA8000-memory.dmp

Filesize
96KB

Download
memory/1128-45-0x00000000020A0000-0x00000000020B6000-memory.dmp

Filesize
88KB

Download
memory/1128-42-0x0000000001DB0000-0x0000000001DC9000-memory.dmp

Filesize
100KB

Download
memory/1128-39-0x0000000000480000-0x0000000000487000-memory.dmp

Filesize
28KB

Download
memory/1128-36-0x0000000001DD0000-0x0000000001DE3000-memory.dmp

Filesize
76KB

Download
memory/1128-125-0x0000000023010000-0x000000002301A000-memory.dmp

Filesize
40KB

Download
memory/1128-33-0x0000000000430000-0x0000000000435000-memory.dmp

Filesize
20KB

Download
memory/1128-30-0x0000000000420000-0x000000000042D000-memory.dmp

Filesize
52KB

Download
memory/1128-27-0x0000000022CD0000-0x0000000022D4F000-memory.dmp

Filesize
508KB

Download
memory/1128-24-0x0000000025130000-0x0000000025972000-memory.dmp

Filesize
8.3MB

Download
memory/1128-48-0x0000000022AE0000-0x0000000022B20000-memory.dmp

Filesize
256KB

Download
memory/1128-127-0x0000000023010000-0x000000002301A000-memory.dmp

Filesize
40KB

Download
memory/1128-21-0x0000000000440000-0x000000000047E000-memory.dmp

Filesize
248KB

Download
memory/1128-15-0x0000000002140000-0x000000000229E000-memory.dmp

Filesize
1.4MB

Download
memory/1128-12-0x00000000231D0000-0x00000000233F8000-memory.dmp

Filesize
2.2MB

Download
memory/1128-60-0x0000000023600000-0x00000000236F4000-memory.dmp

Filesize
976KB

Download
memory/1128-8-0x00000000241A0000-0x0000000025128000-memory.dmp

Filesize
15.5MB

Download
memory/1128-9-0x000000013F900000-0x000000014022D000-memory.dmp

Filesize
9.2MB

Download
memory/1128-245-0x000000013F900000-0x000000014022D000-memory.dmp

Filesize
9.2MB

Download
memory/1128-63-0x0000000002090000-0x0000000002098000-memory.dmp

Filesize
32KB

Download
memory/1128-5-0x0000000180000000-0x0000000180A25000-memory.dmp

Filesize
10.1MB

Download
memory/1128-66-0x0000000022DB0000-0x0000000022DF7000-memory.dmp

Filesize
284KB

Download
memory/1128-247-0x0000000023010000-0x000000002301A000-memory.dmp

Filesize
40KB

Download
memory/1128-69-0x0000000022B20000-0x0000000022B4A000-memory.dmp

Filesize
168KB

Download
memory/1128-72-0x0000000025980000-0x000000002619C000-memory.dmp

Filesize
8.1MB

Download